Information protection mrthod and device

Abstract

An information protection method includes: performing, by a first device, security protection on first information by using a first key; and sending, by the first device, the first information with security protection to a second device, for use by the second device to send the first information with security protection to a third device by the second device.

What is claimed is: 
     
         1 . An information protection method, comprising:
 performing, by a first device, security protection on first information by using a first key; and   sending, by the first device, the first information with the security protection to a second device, for use by the second device to send the first information with the security protection to a third device.   
     
     
         2 . The method of  claim 1 , wherein the security protection comprises integrity protection and/or encryption. 
     
     
         3 . The method of  claim 1 , wherein
 performing, by the first device, the security protection on the first information by using the first key, comprises:
 processing, by the first device, the first information by using the first key, to obtain verification information; and 
   sending, by the first device, the first information with the security protection, comprises:
 sending, by the first device, the first information and the verification information. 
   
     
     
         4 . The method of  claim 1 , wherein
 performing, by the first device, the security protection on the first information by using the first key, comprises:
 performing, by the first device, encryption on the first information by using the first key, to obtain encrypted first information; and 
   sending, by the first device, the first information with the security protection, comprises:
 sending, by the first device, the encrypted first information. 
   
     
     
         5 . The method of  claim 1 , further comprising:
 generating, by the first device, the first key using a second key.   
     
     
         6 . The method of  claim 5 , wherein generating, by the first device, the first key using the second key, comprises:
 generating, by the first device, the first key using the second key before performing the security protection on first information; and/or   generating, by the first device, the first key using the second key according to a predetermined period.   
     
     
         7 . The method of  claim 1 , further comprising:
 sending, by the first device, a key identifier of the first key to the second device.   
     
     
         8 . The method of  claim 7 , wherein
 the key identifier of the first key being comprised in the first information; or the key identifier of the first key being independent of the first information.   
     
     
         9 . The method of  claim 1 , wherein the first device comprises a terminal device, and the third device comprises a network device. 
     
     
         10 . The method of  claim 9 , wherein the first information comprises user consent information. 
     
     
         11 . The method of  claim 9 , further comprising:
 receiving, by the terminal device, an authentication request message; and   generating, by the terminal device, the first key and/or a second key using parameters carried in the authentication request message, the second key being used to generate the first key.   
     
     
         12 . The method of  claim 11 , wherein generating, by the terminal device, the first key and/or the second key using the parameters carried in the authentication request message, comprises:
 generating, by the terminal device, a third key using the parameters carried in the authentication request message; and   generating, by the terminal device, the first key and/or the second key using the third key and other parameters and adopting a key derivation function (KDF).   
     
     
         13 . The method of  claim 12 , wherein the third key comprises at least one of Kausf, Kakma, Kseaf, or Kamf. 
     
     
         14 . The method of  claim 12 , wherein the other parameters comprise at least one of a user equipment (UE) identifier (ID), a random digit (RAND), a counter value, an uplink direction flag, or a downlink direction flag. 
     
     
         15 . The method of  claim 11 , wherein the authentication request message carries a key identifier of the first key. 
     
     
         16 . The method of  claim 1 , wherein the first device comprises a network device, and the third device comprises a terminal device. 
     
     
         17 . The method of  claim 16 , further comprising:
 obtaining, by the network device, the first key from a storage network element.   
     
     
         18 . The method of  claim 17 , wherein obtaining, by the network device, the first key from the storage network element, comprises:
 obtaining, by the network device, the first key from the storage network element before performing the security protection on the first information; and/or   obtaining, by the network device, the first key from the storage network element according to a predetermined period.   
     
     
         19 . A communication device, comprising: a processor and a memory, wherein the memory is configured to store a computer program, and the processor is configured to invoke and execute the computer program stored in the memory to causes the communication device to perform:
 performing security protection on first information by using a first key; and   sending the first information with the security protection to a second device, for use by the second device to send the first information with the security protection to a third device.   
     
     
         20 . A communication device, comprising: a processor and a memory, wherein the memory is configured to store a computer program, and the processor is configured to invoke and execute the computer program stored in the memory to causes the communication device to perform:
 receiving first information with the security protection from a second device, the first information with the security protection being received from the first device and forwarded by the second device; and   performing integrity verification and/or decryption on the first information with the security protection using a first key.